2 Commits

Author	SHA1	Message	Date
admin	229650b4ee	hub v0.38.0: offsite SLICE 2 — capture the box host-key fingerprint ... Descriptor.HostFingerprint (SHA256, non-secret), captured at provision via an x/crypto/ssh keyscan (SSHHostKeyScanner — dials :23, grabs the host key from the handshake, no ssh binary). Fail-closed: nil scanner or scan failure → error (don't serve a descriptor the controller can't verify). Pairs with controller v0.106.0 which re-scans + refuses on mismatch (no blind TOFU). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-09 19:14:36 +02:00
admin	44ec06b50f	hub v0.37.0: offsite provisioning SLICE 1 — Cloud-API client + provisioning core ... Hetzner storage-box provisioning against api.hetzner.com/v1 (NOT .cloud). internal/hetznerapi (typed client + CloudAPI interface + Fake + WaitAction); internal/offsite (Provisioner.ProvisionOffsite — idempotent by label, shared sub-account/dedicated box, transient password, non-secret Descriptor, fail-closed); one_time_secrets store (single-use Save/Consume); POST /offsite/consume-password/{id} (customer-key auth, once); config-form Offsite section → applyOffsite (502+no-save on error) → descriptor in ConfigJSON → version bump. Token/passwords never logged/committed/in ConfigJSON. Tested vs a faked Cloud API + fail-closed red-proof. NOT yet live-provisioned (needs the dedicated-project scoped token; current token can delete ep0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6	2026-07-09 18:38:24 +02:00